hashicorp / terraform-provider-aws

The AWS Provider enables Terraform to manage AWS resources.
https://registry.terraform.io/providers/hashicorp/aws
Mozilla Public License 2.0
9.85k stars 9.2k forks source link

[Bug]: Issue with multiple aws_cloudformation_stack_instances resources on the same aws_cloudformation_stack_set, but with different regions or OUs #40243

Open JorisBoelen-TomTom opened 4 days ago

JorisBoelen-TomTom commented 4 days ago

Terraform Core Version

1.9.8

AWS Provider Version

5.76.0

Affected Resource(s)

Expected Behavior

When deploying multiple aws_cloudformation_stack_instances resources that point to the same aws_cloudformation_stack_set, but have a different value for the parameter regions or organizational_unit_ids, I would expect the resources to only require an update if the value changes, not on each terraform plan/apply

Use case is to deploy a Cloud Formation StackSet to only 1 region for certain accounts, but to multiple regions for other accounts.

Or to deploy a StackSet to all accounts in 1 OU, and only to a limited set of accounts in another OU.

It's not clear to me whether this is a bug, a limitations from AWS or a misunderstand from my side.

Actual Behavior

Initially the resources are created correctly. But on every terraform plan/apply it marks the regions or organizational_unit_ids parameters as being modified, requiring an update of the resource.

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

Example 1: multiple aws_cloudformation_stack_instances resources, but for different regions.

resource "aws_cloudformation_stack_set" "this" {
  name                    = var.cloudformation_stack_set_name
  ...
}

resource "aws_cloudformation_stack_instances" "one" {
  stack_set_name = aws_cloudformation_stack_set.this.name
  regions                = ["eu-west-1"]
  ...
}

resource "aws_cloudformation_stack_instances" "two" {
  stack_set_name = aws_cloudformation_stack_set.this.name
  regions                = ["eu-west-1", "eu-central-1"]
}

Example 2: multiple aws_cloudformation_stack_instances resources, but for different OUs.

resource "aws_cloudformation_stack_set" "this" {
  name                    = var.cloudformation_stack_set_name
  ...
}

resource "aws_cloudformation_stack_instances" "one" {
  stack_set_name = aws_cloudformation_stack_set.this.name
  regions                = ["eu-west-1" "eu-central-1"]

  deployment_targets {
    organizational_unit_ids = ["ou-1234"]
  }
  ...
}

resource "aws_cloudformation_stack_instances" "two" {
  stack_set_name = aws_cloudformation_stack_set.this.name
  regions                = ["eu-west-1", "eu-central-1"]

  deployment_targets {
    organizational_unit_ids = ["ou-1235"]
    account_filter_type = "DIFFERENCE"
    accounts = ["1111111", "222222"]
  }
}

Steps to Reproduce

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

No

github-actions[bot] commented 4 days ago

Community Note

Voting for Prioritization

Volunteering to Work on This Issue